SuperH SH-2E instruction set for Ghidra dissasembly still missing

[1Mike80]

Hi,

In my dissasembly project I am still missing SH-2E instruction set for my SuperH processor Denso SH7058S (ECU in my car). I know, that SH-2A instructions are neraly the same, but NOT at all and it causes problems. In addition, the SH-2E supports single-precision floating point calculations as well as entirely PCAPI compatible emulation of double-precision floating point calculations.
The SH-2E instructions are a subset of the floating point calculations conforming to the IEEE754 standard.
It also covers the pipeline operation, which is a feature of the SH-2E Series. Please can someone help me ? Thank you

[GhidorahRex]

According to the manual, the register set is pretty much identical, and although there are some instructions in the SH-2A that are not supported in the SH-2E, the 2E does contain a subset of them, do you have an example of an instruction that isn't supported in the 2E? The pipeline operation looks like it determines how many instruction cycles each instruction takes, but it's not clear how that impacts the disassembly?

We might need a different cspec if the calling convention is different

[1Mike80]

There are diferences, that can cause bad dissasembly.
SH-2E instruction set is using single precision-floating point instructions.

Differences and similarities:
Included (from SH-2E manual)>
All base SH-1/SH-2 instructions (MOV, ADD, CMP, shifts, branches, etc.)
SH-2 specific: DMULS.L, DMULU.L, DT, MAC.L, MUL.L, BF/S, BT/S, BRAF, BSRF
Single-precision FPU: FABS, FADD, FCMP/EQ, FCMP/GT, FDIV, FLDI0, FLDI1, FLDS, FLOAT, FMAC, FMOV, FMOV.S, FMUL, FNEG, FSTS, FSUB, FTRC
FPU-related CPU: LDS/STS for FPSCR and FPUL

Excluded (SH-2A only, not in instruction set of SH-2E manual):

All 32-bit instruction extensions (MOV with disp12, MOVI20, MOVU, etc.)
FSQRT, FSCHG, FCNVDS, FCNVSD
32-bit FMOV.S @(disp12) variants
TBR register and related instructions (LDC TBR, STC TBR)
Bit manipulation (BAND, BOR, BXOR, BCLR, BSET, BLD, BST, etc.)
CLIPS, CLIPU, DIVS, DIVU, MULR
SHAD, SHLD (variable shifts)
JSR/N, RTS/N, RTV/N
LDBANK, STBANK, RESBANK

[GhidorahRex]

Which instructions are causing bad disassembly?

We don't currently have support for the double-precision floating point in the SuperH, so really only single-precision is supported.

Do you have a sample binary you can add?

[1Mike80]

I cant upload BIN file here, but here are some cases / excercises- this is overall result from AI comparision SH-2A vs SH-2E in Ghidra of my BIN file dissasemlby Here are the key findings:
SH-2A decoded 148 ghost instructions that don't exist on your SH7058S — 142 movi20, 5 movi20s, and 1 shad. These are all SH-2A-only instructions that your chip cannot execute.
SH-2E recovered 21 FPU instructions that SH-2A completely missed — 2 fadd and 19 fmov/fmov.s. At address 0x000037A0, SH-2A showed an entire function epilogue (register restores, FPU register restores) as raw undefined bytes, while SH-2E decoded it perfectly. Same thing at 0x00020800 — a full FPU calculation block with calibration data loads was invisible to SH-2A.
The most dangerous issue was the 11 ghost MOVI20s in the main code region (0x10000–0x8FFFF). Since MOVI20 is a 32-bit instruction but SH-2E only has 16-bit instructions, each false MOVI20 ate the next real instruction and threw off the entire disassembly alignment downstream.